The Sphinx project aims to provide a Universal Cyber Security Toolkit for the Health and Care Domain. This deliverable outlines the basic steps for the implementation of the information security strategy within health sector. Provided that Sphinx R&D activities should comply with established practices as well as the legal framework for ethical, privacy and data protection issues, the deliverable identifies restrictions and provides guidelines in relation to privacy and data protection as well as access to personal information. The goal is to ensure that the project methods, tools, technologies and processes will be able to be adopted without any legal barrier at least as this concerns the national (three pilots) and the European legal and ethical framework and mainly the GDPR.